Overview

overview

10

Static

static

10

ba9f00c6db...df.exe

windows7-x64

10

ba9f00c6db...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba9f00c6db9f9a01986b81f8d335eddf.exe

  • Size

    448KB

  • Sample

    240426-g3keaaaf5t

  • MD5

    ba9f00c6db9f9a01986b81f8d335eddf

  • SHA1

    f9acdbd4b4b860ff5259ea2882e6c553630f23f2

  • SHA256

    6b96466b5accf1c00413d977422a3381ef01013574000bb467a4266301ca6d3d

  • SHA512

    ee5ab56eab6362f1ab5127600cd3d7f06968330b7d707ee74b7a4f7346e105ff3ac0814ab28f5b024af074f67884e3d55bb04da0e5c2efc7fa2536fa535e0b93

  • SSDEEP

    6144:FWoFHzv35jg7aOl3BzrUmKyIxLfYeOO9UmKyIxLiajOEjXP3HBsR4/0ePGSzxC:FXFzhc7aOlxzr3cOK3TajRfXFMKNxC

Score
10/10
berbewbackdoordropperpersistencetrojan

Malware Config

Targets

    • Target

      ba9f00c6db9f9a01986b81f8d335eddf.exe

    • Size

      448KB

    • MD5

      ba9f00c6db9f9a01986b81f8d335eddf

    • SHA1

      f9acdbd4b4b860ff5259ea2882e6c553630f23f2

    • SHA256

      6b96466b5accf1c00413d977422a3381ef01013574000bb467a4266301ca6d3d

    • SHA512

      ee5ab56eab6362f1ab5127600cd3d7f06968330b7d707ee74b7a4f7346e105ff3ac0814ab28f5b024af074f67884e3d55bb04da0e5c2efc7fa2536fa535e0b93

    • SSDEEP

      6144:FWoFHzv35jg7aOl3BzrUmKyIxLfYeOO9UmKyIxLiajOEjXP3HBsR4/0ePGSzxC:FXFzhc7aOlxzr3cOK3TajRfXFMKNxC

    Score
    10/10
    backdoordropperpersistencetrojan

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Malware Dropper & Backdoor - Berbew

      Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

      backdoortrojandropper

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks